CVE-2023-38469

A vulnerability was found in Avahi, where a reachable assertion exists in avahidnspacketappendrecord...

CVE-2023-38469

A vulnerability was found in Avahi, where a reachable assertion exists in avahidnspacketappendrecord...

Avahi security breach

Avahi is a suite of local service discovery tools for Linux. A security vulnerability exists in Avahi that stems from an assertion failure in avahidnspacketappendrecord...

Oracle Linux 5 : squid (ELSA-2010-0221)

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2010-0221 advisory. - Resolves: 561828 - CVE-2009-2855 CVE-2010-0308 squid various flaws rhel-5.5 Tenable has extracted the preceding description block directly from the...

CVE-2023-38469

A vulnerability was found in Avahi, where a reachable assertion exists in avahidnspacketappendrecord...

OSV-2023-305 UNKNOWN READ in page_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57929 Crash type: UNKNOWN READ Crash state: pagesize dnspacketnew dnsresourcerecordnewfromraw...

SUSE CVE-2017-13704

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's 0xffffffffffffffff in 64 bit platforms, making dnsmasq crash...

The vulnerability of the memset() function in the Dnsmasq DNS server allows a hacker to cause a service failure.

The vulnerability of the memset function in the Dnsmasq DNS server is related to insufficient checking of DNS packet size. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted requests to port 53/udp...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary RamdaCVE-2021-42581 is vulnerable to remote attackers to execute arbitrary code on the system, caused by a prototype pollution in functions. An attacker could exploit this vulnerability to execute arbitrary code on the system. Node-forgeCVE-2022-24773, 217313, CVE-2022-24771, CVE-2020-772...

[PNM-002] The expiry of the parent node can be smaller than the one of a child node, violating the guarantee policy

Lines of code Vulnerability details Description By design, the child node's expiry can only be extended up to the parent's current one. Adding these restrictions means that the ENS users only have to look at the name itself's fuses and expiry without traversing the hierarchy to understand what...

GHSA-369H-PJR2-6WRH Uncontrolled recursion in trust-dns-proto

There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression RFC1035 section 4.1.4. The parser could be tricked into infinite loop when a compression offset pointed back to th...

Uncontrolled recursion in trust-dns-proto

There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression RFC1035 section 4.1.4. The parser could be tricked into infinite loop when a compression offset pointed back to th...

Design/Logic Flaw

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service remote. The component is: DNS response processing in function: dnsupcall. The attack vector is: a specific DNS response packet. The code does not check whether the number o...

Unspecified vulnerability in Mathias Buus dns-packet

dns-packet is a software application. An abstraction encodes a dependency model for encoding/decoding DNS packets. A security vulnerability exists in Mathias Buus dns-packet versions prior to 5.2.2, which can be exploited by an attacker to expose internal application memory over an unencrypted...

Memory Exposure

Overview This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names...

@anothersoftware/lotion-connect (>=0.1.23, <=0.1.24), @beaker/core (>=1.0.0, <=3.0.2) +372 more potentially affected by CVE-2021-23386 via dns-packet (>=3.0.1, <=5.2.1)

dns-packet NPM version =3.0.1, =0.1.23, =1.0.0, =1.0.0, =1.2.2-urlencoded, =2.0.6, =2.0.2, =0.0.1, =1.0.0, =1.0.1, =1.0.0, =0.0.1, =1.0.1, =1.0.1, =2.0.0, =2.2.0 and more Source cves: CVE-2021-23386 Source advisory: OSV:GHSA-3WCQ-X3MQ-6R9P...

GHSA-3WCQ-X3MQ-6R9P Potential memory exposure in dns-packet

This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names...

aloha-sd (>=1.0.0, <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (1.1.1)

dns-packet NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: OSV:GHSA-3WCQ-X3MQ-6R9P...

Potential memory exposure in dns-packet

This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names...

CVE-2021-23386

Remote memory exposure vulnerability was found in nodejs dns-packet library. The buffers created with allocUnsafe are not always filled before forming the network packets and an attacker can use this vulnerability to potentially get access to internal application memory over non encrypted network...